Devin Desktop | Golem docs

Connect Devin Desktop, formerly Windsurf, to Golem through its hooks and MCP configuration.

There is nothing to configure by hand. Windsurf was renamed Devin Desktop in June 2026, and its default agent, Devin Local, shares its hooks and settings with the Devin CLI. When you install Golem on a machine that has either, the Golem agent writes its hooks and MCP servers into Devin's configuration. From then on every tool call is checked against your rules before it runs and signed into the record after.

What Golem adds#

Golem writes its part of three places under ~/.config/devin, which the desktop app and the CLI share:

File	What Golem writes
`config.json`	Hooks for `SessionStart`, `UserPromptSubmit`, `PreToolUse` and `PostToolUse`, each running `golem devin-hook <Event>`. Under `permissions.allow`, Golem's read-only tools (`list_agents`, `golem_status`, the timeline and search tools), so Devin runs those without asking. A Golem tool that writes or acts, `send_message` included, still asks.
`mcp_config.json`	Golem's two MCP servers, `golem-witness` and `golem-context`, under `mcpServers`.
`skills/`	Golem's skills.

Your own hooks, approvals and servers are left as they were. Restart Devin after the first install so it loads the new hooks and servers.

Each hook command runs only while the golem binary is present, so a removed binary never stops Devin's work.

The Golem agent recognizes Devin from the desktop app, the CLI, or a Windsurf install. If Devin arrives after Golem, the next check (every 15 minutes by default) wires it. To wire it straight away, run:

golem setup-client

What a block and a hold look like#

A blocked call does not run. Devin shows the model the reason, which names the rule and carries a decision id:

blocked by Golem policy (rule "no-force-push-to-main", decision gd_3f9a1c07b2e4d815). Trying again won't change this. If it's a false positive, the user can ask the security team for an exception: golem exception gd_3f9a1c07b2e4d815 --reason "why".

Devin's hooks can approve or block a call, with no option to ask a person. So a rule set to Ask cannot become an approval prompt here:

The rule asks	In Devin
The person at the keyboard	The call is refused, and the reason says this agent can't ask here. Golem never quietly allows a call it was told to hold.
Your team	The call is refused, and the reason tells the agent your security team decides in the console and to quote the decision id.
Golem's reviewer agent	The call waits while the reviewer decides, for about 35 seconds at most. If no decision has come back yet, the agent is told to wait and retry the same call.

When a rule on the prompt-injection check blocks a tool's result, Devin is told to block it with Golem's reason.

A machine you quarantine is held to its locked-down toolset on this same hook. See Block, hold and contain for the full picture.

What is recorded#

Every tool call before it runs and after it returns, with its arguments. The tool's output is not stored. Devin's tool names are recorded under the names Claude Code uses for the same tools (exec as Bash, read as Read, write as Write, edit and apply_patch as Edit), so one rule covers both agents.
MCP calls Devin makes through its generic mcp_call_tool, recorded as mcp__<server>__<tool> when the call names its server and tool.
Each decision Golem made, signed into the session's record.

Messages from other agents reach a Devin session at its next session start, prompt or tool result. See Agent coordination.

The Golem agent also reads how Devin is set up to run. A session started with --permission-mode bypass, or a config.json whose permissions.allow lists exec outright (every shell command runs without asking), shows under Security Inventory → Agent settings. See Roll out to a fleet.

Check that it is working#

Run golem doctor. It confirms the Golem agent is running and enrolled.
Run golem setup-client. On a wired machine it reports that clients already point at the Golem agent; otherwise it lists the files it changed.
Start a Devin session and ask it which other agents are running on this machine. It should answer from Golem's list_agents tool without asking you first.
In the console at app.golem.team, open Conversations. The session appears under the agent devin.

Limits#

Cascade, Windsurf's older agent, is not covered. Its hooks can block an action but cannot put text in front of the model, so it could never receive a message from another agent. Devin Desktop starts new tabs on Devin Local.
What was said is not recorded. Golem records what the agent did. Your prompts reach the Golem agent only so it can answer with context and messages, and Golem does not hook the model's replies.
Claude Code settings Devin imports are not relied on. Devin reads Claude Code's hooks and MCP servers by default, but Golem's Claude Code hooks are a kind Devin's hooks do not support, so Golem uses the entries above instead.
XDG_CONFIG_HOME is ignored. The Golem agent runs as a background service and cannot see your shell's environment, so it wires ~/.config/devin.
The hooks are written for macOS and Linux shells.
The shell jail does not apply. It covers Claude Code on macOS. See Shell jail and sandbox.
If the Golem agent is down, calls run. The hook allows the call rather than stop your work, and nothing is recorded until it is back.

Remove it#

golem setup-client --remove takes Golem's hooks, approvals, servers and skills out of every AI client on the machine, Devin included, and remembers the choice so the periodic check does not put them back. To remove Golem entirely, see Uninstall.